oracle weblogic-server CVE-2019-2725 vulnerability in Oracle Products
Published on April 26, 2019

product logo product logo
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD

Known Exploited Vulnerability

This Oracle WebLogic Server, Injection vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

The following remediation steps are recommended / required by July 10, 2022: Apply updates per vendor instructions.


Products Associated with CVE-2019-2725

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-2725 are published in these products:

Oracle Weblogic Server
 
Oracle Agile Plm
 
Oracle Communications Converged Application Server
 
Oracle Peoplesoft Enterprise Peopletools
 
Oracle Storagetek Tape Analytics Sw Tool
 
Oracle Tape Library Acsls
 
Oracle Tape Virtual Storage Manager Gui
 
Oracle VM VirtualBox
 
Oracle
 

Affected Versions

Oracle Corporation Tape Library ACSLS Version 8.5 is affected by CVE-2019-2725

Exploit Probability

EPSS
94.47%
Percentile
100.00%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.